75dc3bb3554c36087766d1d7953b50b425b11ffc4c3297e3fee05cef61de7417

Sharing

Copy URL Twitter E-mail

General

Target

75dc3bb3554c36087766d1d7953b50b425b11ffc4c3297e3fee05cef61de7417
Size

7.5MB
MD5

dde1b4e8694a6c2448522cadb4eea455
SHA1

9e775eefa018ee6f7a0761416fd00fdd0f769e8e
SHA256

75dc3bb3554c36087766d1d7953b50b425b11ffc4c3297e3fee05cef61de7417
SHA512

d70217d90972dd2251daf7ea93a09ac6e810ed848c67f068e47551acdef6bbaf89ed6b0ee5f8950d8c751a2ea78d9c3c9c68744bd09d56e50e109545b61e589a
SSDEEP

98304:m0evB++oli3negdZGuIrnvnyu2aFnPmihO0KwVGQoCoosoSgyivs0TuI/MmWmNFG:ip+VbE2yMe+KTQMosGyeSxzmHVN8v0cX

Score

1^/10

Malware Config

Signatures

Files

75dc3bb3554c36087766d1d7953b50b425b11ffc4c3297e3fee05cef61de7417
.exe windows x86

c06acc2a3a092a7fc8d4970114b7230e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

9f:46:92:be:d6:3a:6b:2e:68:f8:c8:9a:e9:58:09:bb
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

13/02/2020, 00:00

Not After

12/02/2022, 23:59

Subject

CN=Tanuj Malik,O=Tanuj Malik,POSTALCODE=110049,STREET=B-19 South Extension -1,L=New Delhi,ST=Delhi,C=IN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:fd:6d:30:fc:a3:ca:51:a8:1b:bc:64:0e:35:03:2d
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

01/02/2010, 00:00

Not After

18/01/2038, 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

af:0e:0e:0d:2c:46:bd:c6:6f:d4:8d:2f:63:bd:2f:94:71:b5:6a:3b:ad:11:32:ea:07:07:9b:52:c3:8e:cd:2d
Signer

Actual PE Digest

af:0e:0e:0d:2c:46:bd:c6:6f:d4:8d:2f:63:bd:2f:94:71:b5:6a:3b:ad:11:32:ea:07:07:9b:52:c3:8e:cd:2d

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Thread32Next
OpenThread
Thread32First
CreateToolhelp32Snapshot
GetLongPathNameW
IsWow64Process
Process32NextW
Process32FirstW
GetPrivateProfileIntW
InterlockedExchange
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
LocalAlloc
VirtualAlloc
lstrcmpA
LoadLibraryExW
InterlockedIncrement
InterlockedDecrement
GlobalUnlock
WriteFile
GetTempFileNameW
DeleteFileW
GetFileSize
WritePrivateProfileStringW
GlobalFree
HeapWalk
HeapLock
HeapUnlock
GetFileSizeEx
SetFilePointerEx
LocalFileTimeToFileTime
SetEnvironmentVariableA
CompareStringW
CompareStringA
CreateFileA
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetTimeZoneInformation
GetLocaleInfoW
FlushFileBuffers
SetStdHandle
GetConsoleMode
GetConsoleCP
GlobalAlloc
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetSystemWindowsDirectoryW
GetTimeFormatA
GetStringTypeW
GetStringTypeA
LCMapStringA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
InitializeCriticalSectionAndSpinCount
SetConsoleCtrlHandler
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleFileNameA
GetStdHandle
FatalAppExitA
HeapCreate
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetModuleHandleA
GetCurrentThread
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStartupInfoW
ExitProcess
VirtualQuery
VirtualProtect
GetSystemTimeAsFileTime
IsDebuggerPresent
UnhandledExceptionFilter
RtlUnwind
lstrlenA
DeviceIoControl
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapSize
HeapReAlloc
HeapDestroy
GetSystemDirectoryW
HeapFree
GlobalReAlloc
FreeResource
MulDiv
LoadLibraryW
FlushInstructionCache
SetLastError
RaiseException
GlobalSize
GlobalLock
GetProcessHeap
GetDateFormatA
CreateEventW
GetTickCount
ResetEvent
CreateThread
SetEvent
ReleaseMutex
WaitForSingleObject
CreateMutexW
lstrcmpiA
FreeLibrary
DeleteCriticalSection
InitializeCriticalSection
InterlockedCompareExchange
Sleep
SetFilePointer
ReadFile
GetSystemInfo
GetWindowsDirectoryW
GetCommandLineW
GetLogicalDriveStringsW
lstrcmpiW
QueryDosDeviceW
lstrcpyW
lstrcatW
LocalFree
GetLastError
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
GetShortPathNameW
OpenProcess
SetUnhandledExceptionFilter
TerminateProcess
GetProcAddress
CreateFileW
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
OutputDebugStringW
CreateDirectoryW
CreateProcessW
CloseHandle
GetModuleFileNameW
GetPrivateProfileStringW
GetVersionExW
GetLocalTime
SystemTimeToFileTime
MultiByteToWideChar
FindResourceExW
LoadResource
LockResource
HeapAlloc
SizeofResource
FindResourceW
WideCharToMultiByte
lstrlenW
IsValidLocale
DebugBreak

user32

CreateWindowExW
GetShellWindow
GetWindowThreadProcessId
RegisterClassW
DefWindowProcW
PostQuitMessage
KillTimer
ShowWindow
SetTimer
IntersectRect
UnregisterClassA
GetWindowLongW
SetWindowPos
SetWindowRgn
MapWindowPoints
GetClientRect
GetMonitorInfoW
MonitorFromWindow
GetWindowRect
GetWindow
GetParent
LoadImageW
GetSystemMetrics
SetWindowLongW
RedrawWindow
MoveWindow
InvalidateRect
DestroyIcon
EndDialog
SendMessageW
PtInRect
GetActiveWindow
DispatchMessageW
TranslateMessage
PeekMessageW
SetForegroundWindow
SystemParametersInfoW
PostMessageW
FindWindowW
IsWindow
SendMessageTimeoutW
AdjustWindowRectEx
CharNextW
GetMessageW
GetClassInfoW
MessageBoxW
EnumWindows
RegisterClassExW
GetClassInfoExW
GetDlgItem
CallWindowProcW
DrawTextW
DrawIconEx
WindowFromPoint
IsWindowVisible
FindWindowExW
ScreenToClient
GetDlgCtrlID
SetFocus
GetCursorPos
GetClassLongW
FillRect
UpdateLayeredWindow
EndPaint
BeginPaint
OffsetRect
UpdateWindow
ReleaseCapture
GetCapture
SetCapture
ReleaseDC
IsRectEmpty
CopyRect
SetRect
DestroyWindow
CreateDialogIndirectParamW
DialogBoxIndirectParamW
GetDesktopWindow
GetDC
LoadCursorW
SetCursor
IsDialogMessageW

gdi32

GetDIBits
CreateCompatibleBitmap
CreateRectRgnIndirect
IntersectClipRect
CreateDIBSection
SetViewportOrgEx
BitBlt
ExcludeClipRect
SetBkColor
ExtTextOutW
StretchBlt
CreateCompatibleDC
GetObjectW
DeleteDC
GetStockObject
CreateSolidBrush
DeleteObject
SelectObject
TextOutW
SetBkMode
GetTextColor
GetClipBox
SetTextColor
SetStretchBltMode
GetObjectA
CreateRoundRectRgn
GetTextExtentPoint32W
CreateRectRgn
CombineRgn
GetDeviceCaps
CreatePolygonRgn
CreateFontIndirectW
CreateDCW
OffsetViewportOrgEx

advapi32

RegQueryValueExA
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
ConvertSidToStringSidW
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
GetTokenInformation
DuplicateTokenEx

shell32

SHGetSpecialFolderPathW
ShellExecuteW
SHGetFileInfoW
CommandLineToArgvW

ole32

GetHGlobalFromStream
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize
CreateStreamOnHGlobal

oleaut32

SysAllocStringLen
VarUI4FromStr
SysStringByteLen
SysAllocStringByteLen
SysAllocString
SysFreeString
VariantInit
VariantClear

shlwapi

PathFileExistsW
PathAppendW
PathFindFileNameW
PathRemoveFileSpecW
StrStrIW
StrChrW
StrCmpNW
PathIsDirectoryW
PathCombineW
StrCmpNIA
StrRChrIW
PathFindExtensionW
StrCmpNIW
StrCmpW
StrChrIW
SHSetValueW
SHGetValueW
StrStrIA
StrCmpIW

comctl32

ImageList_Destroy
ImageList_Create
InitCommonControlsEx
_TrackMouseEvent

msimg32

AlphaBlend

gdiplus

GdiplusStartup
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDrawString
GdipSetTextRenderingHint
GdipStringFormatGetGenericTypographic
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipDeleteStringFormat
GdipCloneStringFormat
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromScan0
GdipAlloc
GdipFree
GdipDrawImageRectRectI
GdipSetSmoothingMode
GdipSetInterpolationMode
GdipDeleteGraphics
GdipCreateFromHDC

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
VerQueryValueA

psapi

EnumProcessModules
GetProcessImageFileNameW
GetModuleFileNameExW

iphlpapi

GetPerAdapterInfo
GetAdaptersInfo

crypt32

CertGetNameStringW
CertFreeCertificateContext
CryptDecodeObject
CryptQueryObject
CryptMsgGetParam
CertCloseStore
CryptMsgClose
CertFindCertificateInStore

imm32

ImmDisableIME

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData

Sections

.text
Size: 1002KB - Virtual size: 1002KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 144KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6.3MB - Virtual size: 6.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c06acc2a3a092a7fc8d4970114b7230e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

9f:46:92:be:d6:3a:6b:2e:68:f8:c8:9a:e9:58:09:bbCertificate

Extended Key Usages

Key Usages

01:fd:6d:30:fc:a3:ca:51:a8:1b:bc:64:0e:35:03:2dCertificate

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

af:0e:0e:0d:2c:46:bd:c6:6f:d4:8d:2f:63:bd:2f:94:71:b5:6a:3b:ad:11:32:ea:07:07:9b:52:c3:8e:cd:2dSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

gdiplus

version

psapi

iphlpapi

crypt32

imm32

wintrust

Sections

.text Size: 1002KB - Virtual size: 1002KB

.rdata Size: 144KB - Virtual size: 144KB

.data Size: 22KB - Virtual size: 57KB

.rsrc Size: 6.3MB - Virtual size: 6.3MB

.reloc Size: 33KB - Virtual size: 32KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

9f:46:92:be:d6:3a:6b:2e:68:f8:c8:9a:e9:58:09:bb
Certificate

01:fd:6d:30:fc:a3:ca:51:a8:1b:bc:64:0e:35:03:2d
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

af:0e:0e:0d:2c:46:bd:c6:6f:d4:8d:2f:63:bd:2f:94:71:b5:6a:3b:ad:11:32:ea:07:07:9b:52:c3:8e:cd:2d
Signer

.text
Size: 1002KB - Virtual size: 1002KB

.rdata
Size: 144KB - Virtual size: 144KB

.data
Size: 22KB - Virtual size: 57KB

.rsrc
Size: 6.3MB - Virtual size: 6.3MB

.reloc
Size: 33KB - Virtual size: 32KB